@jobshimo/browser-link 0.8.5 → 0.9.1

package/dist/bridge/events.d.ts

@@ -36,4 +36,7 @@ export declare class BridgeEventLog {
     latestId(): number;
     /** Total number of events in the buffer. */
     size(): number;
+    /** Drop every event in the buffer and reset the id counter. Returns the
+     * count dropped, so callers can surface it (used by `browser.reset`). */
+    clear(): number;
 }

package/dist/bridge/events.js

@@ -44,5 +44,13 @@ export class BridgeEventLog {
     size() {
         return this.buffer.length;
     }
+    /** Drop every event in the buffer and reset the id counter. Returns the
+     * count dropped, so callers can surface it (used by `browser.reset`). */
+    clear() {
+        const dropped = this.buffer.length;
+        this.buffer = [];
+        this.nextId = 1;
+        return dropped;
+    }
 }
 //# sourceMappingURL=events.js.map

package/dist/bridge/events.js.map

@@ -1 +1 @@
-{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/bridge/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAqBH,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,MAAM,OAAO,cAAc;IACjB,MAAM,GAAkB,EAAE,CAAC;IAC3B,MAAM,GAAG,CAAC,CAAC;IAEnB,6EAA6E;IAC7E,GAAG,CAAC,IAAqB,EAAE,OAAgC,EAAE;QAC3D,MAAM,KAAK,GAAgB;YACzB,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;YACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI;YACJ,IAAI;SACL,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;oDAEgD;IAChD,MAAM,CAAC,OAA6C,EAAE;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,MAAM,QAAQ,GACZ,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;QAClF,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,2DAA2D;IAC3D,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,4CAA4C;IAC5C,IAAI;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;CACF"}
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/bridge/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAqBH,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,MAAM,OAAO,cAAc;IACjB,MAAM,GAAkB,EAAE,CAAC;IAC3B,MAAM,GAAG,CAAC,CAAC;IAEnB,6EAA6E;IAC7E,GAAG,CAAC,IAAqB,EAAE,OAAgC,EAAE;QAC3D,MAAM,KAAK,GAAgB;YACzB,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;YACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI;YACJ,IAAI;SACL,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;oDAEgD;IAChD,MAAM,CAAC,OAA6C,EAAE;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,MAAM,QAAQ,GACZ,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;QAClF,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,2DAA2D;IAC3D,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,4CAA4C;IAC5C,IAAI;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED;6EACyE;IACzE,KAAK;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAChB,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/commands/welcome.d.ts

@@ -15,6 +15,10 @@ export interface WelcomeOptions {
 }
 interface I18n {
     title: string;
+    /** One-paragraph mission statement for the compact (default) view. */
+    shortAbout: string;
+    /** One-line critical warning for the compact (default) view. */
+    shortWarning: string;
     aboutTitle: string;
     about: string;
     capabilitiesTitle: string;
@@ -24,12 +28,23 @@ interface I18n {
     responsibility: string;
     extensionNote: string;
     prompt: string;
+    /** Trailing hint pointing at where the full breakdown lives. */
+    detailHint: string;
     options: {
         accept: string;
         dismiss: string;
         swap: string;
         quit: string;
     };
+    /** Footer keycap labels — language-stable except for the verb. */
+    footerKeys: {
+        navigate: string;
+        select: string;
+        lang: string;
+        quit: string;
+        info: string;
+        hide: string;
+    };
 }
 export declare const I18N_WELCOME: Record<Language, I18n>;
 export {};

package/dist/commands/welcome.js

@@ -4,6 +4,15 @@
 export const I18N_WELCOME = {
     en: {
         title: 'browser-link',
+        shortAbout: [
+            'MCP bridge between your editor agent and the Chrome tabs you',
+            'explicitly enable through a companion extension.',
+        ].join('\n'),
+        shortWarning: [
+            'The agent can read and write whatever is on a connected tab —',
+            'sessions, wallets, admin panels. Only connect tabs you would let',
+            'a remote junior dev touch.',
+        ].join('\n'),
         aboutTitle: 'What this is',
         about: [
             'An MCP server that opens a small WebSocket bridge between an MCP',
@@ -40,15 +49,36 @@ export const I18N_WELCOME = {
         responsibility: 'You are responsible for every action the agent performs on the tabs you explicitly enable. The extension stays inert on any tab where you have not pressed "Conectar" yourself.',
         extensionNote: 'The Chrome extension is custom and ships inside this package. The setup menu after this screen will tell you where it lives so you can load it via chrome://extensions → Load unpacked.',
         prompt: 'How do you want to proceed?',
+        detailHint: 'Press i for the full breakdown · also available under About.',
         options: {
             accept: 'I understand, continue',
             dismiss: "Accept and don't show again",
-            swap: 'Switch to español',
+            // Label sits in the destination language so a monolingual user
+            // can still parse it — they recognise "Español" universally and
+            // the verb in the destination language confirms it is the switch.
+            swap: 'Cambiar a Español',
             quit: 'Quit',
         },
+        footerKeys: {
+            navigate: 'navigate',
+            select: 'select',
+            lang: 'lang',
+            quit: 'quit',
+            info: 'info',
+            hide: 'hide',
+        },
     },
     es: {
         title: 'browser-link',
+        shortAbout: [
+            'Puente MCP entre el agente de tu editor y las pestañas de Chrome',
+            'que vos habilitás explícitamente a través de una extensión.',
+        ].join('\n'),
+        shortWarning: [
+            'El agente puede leer y escribir todo lo que esté en una pestaña',
+            'conectada — sesiones, wallets, paneles de admin. Solo conectá',
+            'pestañas que dejarías tocar a un dev junior remoto.',
+        ].join('\n'),
         aboutTitle: 'Qué es esto',
         about: [
             'Un servidor MCP que abre un puente WebSocket entre un cliente MCP',
@@ -87,12 +117,24 @@ export const I18N_WELCOME = {
         responsibility: 'Sos responsable de cada acción que el agente haga en las pestañas que habilitás explícitamente. La extensión se mantiene inerte en cualquier pestaña donde no hayas apretado "Conectar" vos mismo.',
         extensionNote: 'La extensión de Chrome es custom y viene incluida en este paquete. El menú que aparece después de esta pantalla te dice exactamente dónde está para que la cargues vía chrome://extensions → Cargar sin empaquetar.',
         prompt: '¿Cómo querés seguir?',
+        detailHint: 'Apretá i para ver el detalle completo · también disponible en About.',
         options: {
             accept: 'Entendido, continuar',
             dismiss: 'Aceptar y no volver a mostrar',
-            swap: 'Cambiar a English',
+            // El label vive en el idioma destino para que un user monolingüe
+            // lo lea sin esfuerzo — "English" se reconoce universalmente y el
+            // verbo en el idioma destino confirma que es el switch.
+            swap: 'Switch to English',
             quit: 'Salir',
         },
+        footerKeys: {
+            navigate: 'moverse',
+            select: 'elegir',
+            lang: 'idioma',
+            quit: 'salir',
+            info: 'info',
+            hide: 'ocultar',
+        },
     },
 };
 //# sourceMappingURL=welcome.js.map

package/dist/commands/welcome.js.map

@@ -1 +1 @@
-{"version":3,"file":"welcome.js","sourceRoot":"","sources":["../../src/commands/welcome.ts"],"names":[],"mappings":"AAAA;;yDAEyD;AAkCzD,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD,EAAE,EAAE;QACF,KAAK,EAAE,cAAc;QACrB,UAAU,EAAE,cAAc;QAC1B,KAAK,EAAE;YACL,kEAAkE;YAClE,oEAAoE;YACpE,uEAAuE;YACvE,6BAA6B;SAC9B,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,iBAAiB,EAAE,0CAA0C;QAC7D,YAAY,EAAE;YACZ,gCAAgC;YAChC,6CAA6C;YAC7C,oCAAoC;YACpC,oDAAoD;YACpD,EAAE;YACF,oEAAoE;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,4CAA4C;SAC7C,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,YAAY,EAAE,+BAA+B;QAC7C,OAAO,EAAE;YACP,oEAAoE;YACpE,sEAAsE;YACtE,2DAA2D;YAC3D,EAAE;YACF,uEAAuE;YACvE,wEAAwE;YACxE,qEAAqE;YACrE,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,4BAA4B;SAC7B,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,cAAc,EACZ,iLAAiL;QACnL,aAAa,EACX,yLAAyL;QAC3L,MAAM,EAAE,6BAA6B;QACrC,OAAO,EAAE;YACP,MAAM,EAAE,wBAAwB;YAChC,OAAO,EAAE,6BAA6B;YACtC,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,MAAM;SACb;KACF;IACD,EAAE,EAAE;QACF,KAAK,EAAE,cAAc;QACrB,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE;YACL,mEAAmE;YACnE,uEAAuE;YACvE,wEAAwE;YACxE,6BAA6B;SAC9B,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,iBAAiB,EAAE,oDAAoD;QACvE,YAAY,EAAE;YACZ,uCAAuC;YACvC,+CAA+C;YAC/C,2CAA2C;YAC3C,8DAA8D;YAC9D,EAAE;YACF,qEAAqE;YACrE,uEAAuE;YACvE,yEAAyE;YACzE,iDAAiD;SAClD,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,YAAY,EAAE,0BAA0B;QACxC,OAAO,EAAE;YACP,uEAAuE;YACvE,kEAAkE;YAClE,qEAAqE;YACrE,wCAAwC;YACxC,EAAE;YACF,iEAAiE;YACjE,4DAA4D;YAC5D,qEAAqE;YACrE,oCAAoC;YACpC,EAAE;YACF,oEAAoE;YACpE,uEAAuE;YACvE,4BAA4B;SAC7B,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,cAAc,EACZ,oMAAoM;QACtM,aAAa,EACX,qNAAqN;QACvN,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE;YACP,MAAM,EAAE,sBAAsB;YAC9B,OAAO,EAAE,+BAA+B;YACxC,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,OAAO;SACd;KACF;CACF,CAAC"}
+{"version":3,"file":"welcome.js","sourceRoot":"","sources":["../../src/commands/welcome.ts"],"names":[],"mappings":"AAAA;;yDAEyD;AAiDzD,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD,EAAE,EAAE;QACF,KAAK,EAAE,cAAc;QACrB,UAAU,EAAE;YACV,8DAA8D;YAC9D,kDAAkD;SACnD,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,YAAY,EAAE;YACZ,+DAA+D;YAC/D,kEAAkE;YAClE,4BAA4B;SAC7B,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,UAAU,EAAE,cAAc;QAC1B,KAAK,EAAE;YACL,kEAAkE;YAClE,oEAAoE;YACpE,uEAAuE;YACvE,6BAA6B;SAC9B,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,iBAAiB,EAAE,0CAA0C;QAC7D,YAAY,EAAE;YACZ,gCAAgC;YAChC,6CAA6C;YAC7C,oCAAoC;YACpC,oDAAoD;YACpD,EAAE;YACF,oEAAoE;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,4CAA4C;SAC7C,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,YAAY,EAAE,+BAA+B;QAC7C,OAAO,EAAE;YACP,oEAAoE;YACpE,sEAAsE;YACtE,2DAA2D;YAC3D,EAAE;YACF,uEAAuE;YACvE,wEAAwE;YACxE,qEAAqE;YACrE,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,4BAA4B;SAC7B,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,cAAc,EACZ,iLAAiL;QACnL,aAAa,EACX,yLAAyL;QAC3L,MAAM,EAAE,6BAA6B;QACrC,UAAU,EAAE,8DAA8D;QAC1E,OAAO,EAAE;YACP,MAAM,EAAE,wBAAwB;YAChC,OAAO,EAAE,6BAA6B;YACtC,+DAA+D;YAC/D,gEAAgE;YAChE,kEAAkE;YAClE,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,MAAM;SACb;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,MAAM;SACb;KACF;IACD,EAAE,EAAE;QACF,KAAK,EAAE,cAAc;QACrB,UAAU,EAAE;YACV,kEAAkE;YAClE,6DAA6D;SAC9D,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,YAAY,EAAE;YACZ,iEAAiE;YACjE,+DAA+D;YAC/D,qDAAqD;SACtD,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE;YACL,mEAAmE;YACnE,uEAAuE;YACvE,wEAAwE;YACxE,6BAA6B;SAC9B,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,iBAAiB,EAAE,oDAAoD;QACvE,YAAY,EAAE;YACZ,uCAAuC;YACvC,+CAA+C;YAC/C,2CAA2C;YAC3C,8DAA8D;YAC9D,EAAE;YACF,qEAAqE;YACrE,uEAAuE;YACvE,yEAAyE;YACzE,iDAAiD;SAClD,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,YAAY,EAAE,0BAA0B;QACxC,OAAO,EAAE;YACP,uEAAuE;YACvE,kEAAkE;YAClE,qEAAqE;YACrE,wCAAwC;YACxC,EAAE;YACF,iEAAiE;YACjE,4DAA4D;YAC5D,qEAAqE;YACrE,oCAAoC;YACpC,EAAE;YACF,oEAAoE;YACpE,uEAAuE;YACvE,4BAA4B;SAC7B,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,cAAc,EACZ,oMAAoM;QACtM,aAAa,EACX,qNAAqN;QACvN,MAAM,EAAE,sBAAsB;QAC9B,UAAU,EAAE,sEAAsE;QAClF,OAAO,EAAE;YACP,MAAM,EAAE,sBAAsB;YAC9B,OAAO,EAAE,+BAA+B;YACxC,iEAAiE;YACjE,kEAAkE;YAClE,wDAAwD;YACxD,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,OAAO;SACd;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;SAChB;KACF;CACF,CAAC"}

package/dist/extension/background.js

@@ -2,6 +2,19 @@ const WS_URL = 'ws://127.0.0.1:17529';
 const CDP_VERSION = '1.3';
 const CONSOLE_BUFFER_MAX = 200;
 const NETWORK_BUFFER_MAX = 200;
+/* Idle TTL for a tab's WebSocket bridge.
+ *
+ * After this many milliseconds without a tool.request from the server,
+ * the extension closes its side of the WS and detaches the debugger.
+ * The popup then shows "Not connected" again and the user explicitly
+ * re-presses Connect when they want to reactivate.
+ *
+ * This replaces the previous behaviour where the bridge implicitly
+ * died together with the MCP server subprocess (parent_death_guard,
+ * removed in v0.9.0). Lifecycle is now client-side: agent activity
+ * keeps the tab warm, silence eventually parks it. */
+const WS_IDLE_TTL_MS = 30 * 60 * 1000;
+const WS_IDLE_SWEEP_MS = 60 * 1000;
 function isRuntimeMessage(msg) {
     if (typeof msg !== 'object' || msg === null)
         return false;
@@ -25,6 +38,124 @@ function safeParse(raw) {
 function cdp(tabId, method, params = {}) {
     return chrome.debugger.sendCommand({ tabId }, method, params);
 }
+/**
+ * Defensive caps applied to every duration that ends up in a setTimeout
+ * driven by tool params. The MCP request payload is technically untrusted
+ * input, so CodeQL flags unbounded user-controlled timer durations as a
+ * resource-exhaustion risk. We clamp at the boundary (drag handler) AND
+ * inside `sleep` so the property is enforced even if a future call site
+ * forgets to validate.
+ */
+const MAX_DRAG_DURATION_MS = 60_000;
+const MAX_DRAG_HOLD_MS = 10_000;
+function sleep(ms) {
+    // Range-branch sanitizer for CodeQL's js/resource-exhaustion: the
+    // setTimeout call is INSIDE a literal-bounded range check. Caller-side
+    // clamping in the drag handler is the first line of defence; this is
+    // the second.
+    return new Promise((resolve) => {
+        if (typeof ms === 'number' && ms > 0 && ms < 60_000) {
+            setTimeout(resolve, ms);
+        }
+        else {
+            setTimeout(resolve, 0);
+        }
+    });
+}
+/**
+ * Wait for ONE CDP event of a given method on a given tab. Adds a temporary
+ * chrome.debugger.onEvent listener for the duration of the wait. Resolves
+ * with the event params, or null on timeout. Always cleans up its listener.
+ *
+ * Used by the drag tool to capture Input.dragIntercepted while
+ * Input.setInterceptDrags is enabled.
+ */
+function waitForCdpEvent(tabId, method, timeoutMs) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const handler = (source, m, params) => {
+            if (settled)
+                return;
+            if (source.tabId !== tabId)
+                return;
+            if (m !== method)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            chrome.debugger.onEvent.removeListener(handler);
+            resolve((params ?? null));
+        };
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            chrome.debugger.onEvent.removeListener(handler);
+            resolve(null);
+        }, timeoutMs);
+        chrome.debugger.onEvent.addListener(handler);
+    });
+}
+/**
+ * Build the JS expression that:
+ *  1. scrollIntoView(center) for any selector-based endpoint (so both are
+ *     visible at the same time if possible),
+ *  2. detects HTML5 native drag eligibility on the source (`element.draggable`
+ *     true, or implicit via <img> / <a href>),
+ *  3. reads the final centre coords AFTER both scrolls have happened,
+ *  4. flags in_viewport so the caller can refuse offscreen drags instead of
+ *     dispatching cursor events into nowhere.
+ *
+ * Returns one of:
+ *  - `{ err: string }`           — selector miss or stale element
+ *  - `{ from, to, draggable }`   — ready to drag
+ */
+function buildDragProbeExpr(params) {
+    return `
+    (() => {
+      const P = ${JSON.stringify(params)};
+      function scrollAndProbe(sel) {
+        const el = document.querySelector(sel);
+        if (!el) return { err: 'not_found' };
+        el.scrollIntoView({ block: 'center', inline: 'center', behavior: 'instant' });
+        return {
+          draggable:
+            el.draggable === true ||
+            el instanceof HTMLImageElement ||
+            (el instanceof HTMLAnchorElement && !!el.href),
+        };
+      }
+      function readCenter(sel) {
+        const el = document.querySelector(sel);
+        if (!el) return null;
+        const r = el.getBoundingClientRect();
+        return {
+          x: r.left + r.width / 2,
+          y: r.top + r.height / 2,
+          in_viewport:
+            r.bottom > 0 && r.right > 0 && r.top < innerHeight && r.left < innerWidth,
+        };
+      }
+      let fromHint = null;
+      if (P.from_selector) {
+        fromHint = scrollAndProbe(P.from_selector);
+        if (fromHint.err) return { err: 'from_selector not found: ' + P.from_selector };
+      }
+      if (P.to_selector) {
+        const t = scrollAndProbe(P.to_selector);
+        if (t.err) return { err: 'to_selector not found: ' + P.to_selector };
+      }
+      const from = P.from_selector
+        ? readCenter(P.from_selector)
+        : { x: P.from_x, y: P.from_y, in_viewport: true };
+      const to = P.to_selector
+        ? readCenter(P.to_selector)
+        : { x: P.to_x, y: P.to_y, in_viewport: true };
+      if (!from) return { err: 'from element disappeared between probes' };
+      if (!to) return { err: 'to element disappeared between probes' };
+      return { from, to, draggable: fromHint ? fromHint.draggable : false };
+    })()
+  `;
+}
 // Convert an arbitrary console arg (`unknown`) into something printable
 // without leaking `[object Object]`. Used by the console buffer when CDP
 // hands us values we don't statically know.
@@ -366,6 +497,262 @@ async function handleTool(state, msg) {
                     result: { typed: text.length, selector },
                 };
             }
+            case 'drag': {
+                const optNum = (key) => {
+                    const v = p[key];
+                    return typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : undefined;
+                };
+                const clamp = (v, max) => Math.min(v, max);
+                const fromSelector = optStr('from_selector');
+                const toSelector = optStr('to_selector');
+                const fromXRaw = optNum('from_x');
+                const fromYRaw = optNum('from_y');
+                const toXRaw = optNum('to_x');
+                const toYRaw = optNum('to_y');
+                // Cap every duration that ends up in a setTimeout to keep CodeQL's
+                // "user-controlled timer duration" check happy and to prevent a
+                // misbehaving agent from parking the bridge for hours on a typo.
+                const durationMs = clamp(optNum('duration_ms') ?? 1500, MAX_DRAG_DURATION_MS);
+                const holdBeforeMoveMs = clamp(optNum('hold_before_move_ms') ?? 0, MAX_DRAG_HOLD_MS);
+                const holdBeforeReleaseMs = clamp(optNum('hold_before_release_ms') ?? 0, MAX_DRAG_HOLD_MS);
+                const hasFromCoords = fromXRaw !== undefined && fromYRaw !== undefined;
+                const hasToCoords = toXRaw !== undefined && toYRaw !== undefined;
+                if (!fromSelector && !hasFromCoords) {
+                    return {
+                        kind: 'tool.response',
+                        id: msg.id,
+                        ok: false,
+                        error: 'drag: provide from_selector or both from_x and from_y',
+                    };
+                }
+                if (!toSelector && !hasToCoords) {
+                    return {
+                        kind: 'tool.response',
+                        id: msg.id,
+                        ok: false,
+                        error: 'drag: provide to_selector or both to_x and to_y',
+                    };
+                }
+                const probeExpr = buildDragProbeExpr({
+                    from_selector: fromSelector,
+                    to_selector: toSelector,
+                    from_x: fromXRaw,
+                    from_y: fromYRaw,
+                    to_x: toXRaw,
+                    to_y: toYRaw,
+                });
+                const probe = await evaluateInTab(tabId, probeExpr);
+                if (probe.err) {
+                    return { kind: 'tool.response', id: msg.id, ok: false, error: `drag: ${probe.err}` };
+                }
+                if (!probe.from || !probe.to) {
+                    return {
+                        kind: 'tool.response',
+                        id: msg.id,
+                        ok: false,
+                        error: 'drag: could not resolve coordinates',
+                    };
+                }
+                if (!probe.from.in_viewport) {
+                    return {
+                        kind: 'tool.response',
+                        id: msg.id,
+                        ok: false,
+                        error: 'drag: source point is offscreen — scroll first or pass viewport coords',
+                    };
+                }
+                if (!probe.to.in_viewport) {
+                    return {
+                        kind: 'tool.response',
+                        id: msg.id,
+                        ok: false,
+                        error: 'drag: destination point is offscreen — scroll first or pass viewport coords',
+                    };
+                }
+                const fromX = probe.from.x;
+                const fromY = probe.from.y;
+                const toX = probe.to.x;
+                const toY = probe.to.y;
+                const isDraggable = !!probe.draggable;
+                // ~30fps interpolation; minimum 2 steps so the path actually has a midpoint.
+                const steps = durationMs > 0 ? Math.max(2, Math.round(durationMs / 33)) : 1;
+                const stepDelayMs = steps > 0 ? durationMs / steps : 0;
+                const eventsFired = [];
+                let dragMode = 'pointer';
+                const dragStart = Date.now();
+                let interceptionEnabled = false;
+                const interpolate = (t) => ({
+                    x: fromX + (toX - fromX) * t,
+                    y: fromY + (toY - fromY) * t,
+                });
+                try {
+                    if (isDraggable) {
+                        try {
+                            await cdp(tabId, 'Input.setInterceptDrags', { enabled: true });
+                            interceptionEnabled = true;
+                        }
+                        catch {
+                            // setInterceptDrags is experimental — fall back to pointer mode silently.
+                        }
+                    }
+                    if (interceptionEnabled) {
+                        // Arm the listener BEFORE the press+wiggle that may trigger it.
+                        const interceptPromise = waitForCdpEvent(tabId, 'Input.dragIntercepted', 120);
+                        await cdp(tabId, 'Input.dispatchMouseEvent', {
+                            type: 'mouseMoved',
+                            x: fromX,
+                            y: fromY,
+                        });
+                        await cdp(tabId, 'Input.dispatchMouseEvent', {
+                            type: 'mousePressed',
+                            x: fromX,
+                            y: fromY,
+                            button: 'left',
+                            clickCount: 1,
+                        });
+                        if (holdBeforeMoveMs > 0)
+                            await sleep(holdBeforeMoveMs);
+                        // Small wiggle toward the destination so Chrome's native drag system
+                        // crosses its activation threshold. Direction matters for some libs.
+                        const dx = toX - fromX;
+                        const dy = toY - fromY;
+                        const len = Math.hypot(dx, dy) || 1;
+                        const wx = fromX + (dx / len) * 5;
+                        const wy = fromY + (dy / len) * 5;
+                        await cdp(tabId, 'Input.dispatchMouseEvent', { type: 'mouseMoved', x: wx, y: wy });
+                        const intercepted = await interceptPromise;
+                        if (intercepted) {
+                            dragMode = 'html5';
+                            eventsFired.push('Input.dragIntercepted');
+                            const dragData = intercepted.data;
+                            for (let i = 1; i <= steps; i++) {
+                                const t = i / steps;
+                                const { x, y } = interpolate(t);
+                                await cdp(tabId, 'Input.dispatchMouseEvent', { type: 'mouseMoved', x, y });
+                                await cdp(tabId, 'Input.dispatchDragEvent', {
+                                    type: 'dragOver',
+                                    x,
+                                    y,
+                                    data: dragData,
+                                });
+                                if (i === 1)
+                                    eventsFired.push('dragOver');
+                                if (stepDelayMs > 0)
+                                    await sleep(stepDelayMs);
+                            }
+                            await cdp(tabId, 'Input.dispatchDragEvent', {
+                                type: 'dragEnter',
+                                x: toX,
+                                y: toY,
+                                data: dragData,
+                            });
+                            eventsFired.push('dragEnter');
+                            await cdp(tabId, 'Input.dispatchDragEvent', {
+                                type: 'dragOver',
+                                x: toX,
+                                y: toY,
+                                data: dragData,
+                            });
+                            if (holdBeforeReleaseMs > 0)
+                                await sleep(holdBeforeReleaseMs);
+                            await cdp(tabId, 'Input.dispatchDragEvent', {
+                                type: 'drop',
+                                x: toX,
+                                y: toY,
+                                data: dragData,
+                            });
+                            eventsFired.push('drop');
+                            await cdp(tabId, 'Input.dispatchMouseEvent', {
+                                type: 'mouseReleased',
+                                x: toX,
+                                y: toY,
+                                button: 'left',
+                                clickCount: 1,
+                            });
+                        }
+                        else {
+                            // Element was tagged draggable but no native drag fired — the page
+                            // either preventDefault'd dragstart or wires its own pointer logic.
+                            // Continue with pointer-only events from where we already pressed.
+                            dragMode = 'pointer';
+                            for (let i = 1; i <= steps; i++) {
+                                const t = i / steps;
+                                const { x, y } = interpolate(t);
+                                await cdp(tabId, 'Input.dispatchMouseEvent', { type: 'mouseMoved', x, y });
+                                if (stepDelayMs > 0)
+                                    await sleep(stepDelayMs);
+                            }
+                            if (holdBeforeReleaseMs > 0)
+                                await sleep(holdBeforeReleaseMs);
+                            await cdp(tabId, 'Input.dispatchMouseEvent', {
+                                type: 'mouseReleased',
+                                x: toX,
+                                y: toY,
+                                button: 'left',
+                                clickCount: 1,
+                            });
+                        }
+                    }
+                    else {
+                        // Pointer-only branch: no native drag involvement at all.
+                        dragMode = 'pointer';
+                        await cdp(tabId, 'Input.dispatchMouseEvent', {
+                            type: 'mouseMoved',
+                            x: fromX,
+                            y: fromY,
+                        });
+                        await cdp(tabId, 'Input.dispatchMouseEvent', {
+                            type: 'mousePressed',
+                            x: fromX,
+                            y: fromY,
+                            button: 'left',
+                            clickCount: 1,
+                        });
+                        if (holdBeforeMoveMs > 0)
+                            await sleep(holdBeforeMoveMs);
+                        for (let i = 1; i <= steps; i++) {
+                            const t = i / steps;
+                            const { x, y } = interpolate(t);
+                            await cdp(tabId, 'Input.dispatchMouseEvent', { type: 'mouseMoved', x, y });
+                            if (stepDelayMs > 0)
+                                await sleep(stepDelayMs);
+                        }
+                        if (holdBeforeReleaseMs > 0)
+                            await sleep(holdBeforeReleaseMs);
+                        await cdp(tabId, 'Input.dispatchMouseEvent', {
+                            type: 'mouseReleased',
+                            x: toX,
+                            y: toY,
+                            button: 'left',
+                            clickCount: 1,
+                        });
+                    }
+                }
+                finally {
+                    // Critical: leaving interception on would block the human user from
+                    // dragging anything in this tab. Best-effort cleanup, swallow errors.
+                    if (interceptionEnabled) {
+                        try {
+                            await cdp(tabId, 'Input.setInterceptDrags', { enabled: false });
+                        }
+                        catch {
+                            // ignore
+                        }
+                    }
+                }
+                return {
+                    kind: 'tool.response',
+                    id: msg.id,
+                    ok: true,
+                    result: {
+                        from: { x: fromX, y: fromY, selector: fromSelector ?? null },
+                        to: { x: toX, y: toY, selector: toSelector ?? null },
+                        duration_ms_actual: Date.now() - dragStart,
+                        drag_mode: dragMode,
+                        events_fired: eventsFired,
+                    },
+                };
+            }
             case 'evaluate': {
                 const expression = str('expression');
                 const value = await evaluateInTab(tabId, expression);
@@ -474,6 +861,7 @@ async function connectTab(tabId) {
         consoleBuffer: [],
         networkBuffer: new Map(),
         networkOrder: [],
+        lastActivityAt: Date.now(),
     };
     tabStates.set(tabId, state);
     attachDebuggerListener(state);
@@ -527,7 +915,9 @@ async function connectTab(tabId) {
                     return;
                 }
                 // ServerToExtension is the union { tab.registered | tool.request },
-                // so by elimination this branch handles the tool.request case.
+                // so by elimination this branch handles the tool.request case. Touch
+                // the activity timestamp so the WS-idle sweeper keeps this tab warm.
+                state.lastActivityAt = Date.now();
                 const response = await handleTool(state, msg);
                 if (ws.readyState === WebSocket.OPEN)
                     send(ws, response);
@@ -594,5 +984,25 @@ chrome.debugger.onDetach.addListener((source) => {
         // Best effort.
     });
 });
+/* WS-idle sweeper.
+ *
+ * Every WS_IDLE_SWEEP_MS, walk every connected tab. Any tab whose last
+ * tool.request landed more than WS_IDLE_TTL_MS ago gets disconnected:
+ * the WS closes, the debugger detaches, the popup goes back to "Not
+ * connected". The user explicitly re-presses Connect to bring it back.
+ *
+ * This is the replacement for the parent_death_guard that used to kill
+ * the entire MCP server on stdio close — now the server stays alive and
+ * the bridge is parked tab-by-tab from the client side. */
+setInterval(() => {
+    const now = Date.now();
+    for (const [tabId, state] of tabStates) {
+        if (now - state.lastActivityAt < WS_IDLE_TTL_MS)
+            continue;
+        void cleanup(tabId).catch(() => {
+            // Best effort.
+        });
+    }
+}, WS_IDLE_SWEEP_MS);
 export {};
 //# sourceMappingURL=background.js.map